Efficient pattern matching algorithm for memory architecture

Cheng Hung Lin, Shih Chieh Chang

Research output: Contribution to journalArticle

21 Citations (Scopus)

Abstract

Network intrusion detection system is used to inspect packet contents against thousands of predefined malicious or suspicious patterns. Because traditional software alone pattern matching approaches can no longer meet the high throughput of today's networking, many hardware approaches are proposed to accelerate pattern matching. Among hardware approaches, memory-based architecture has attracted a lot of attention because of its easy reconfigurability and scalability. In order to accommodate the increasing number of attack patterns and meet the throughput requirement of networks, a successful network intrusion detection system must have a memory-efficient pattern-matching algorithm and hardware design. In this paper, we propose a memory-efficient pattern-matching algorithm which can significantly reduce the memory requirement. For Snort rule sets, the new algorithm achieves 21% of memory reduction compared with the traditional AhoCorasick algorithm. In addition, we can gain 24% of memory reduction by integrating our approach to the bit-split algorithm which is the state-of-the-art memory-based approach.

Original languageEnglish
Article number5272427
Pages (from-to)33-41
Number of pages9
JournalIEEE Transactions on Very Large Scale Integration (VLSI) Systems
Volume19
Issue number1
DOIs
Publication statusPublished - 2011 Jan 1

Keywords

  • AhoCorasick (AC) algorithm
  • finite automata
  • pattern matching

ASJC Scopus subject areas

  • Software
  • Hardware and Architecture
  • Electrical and Electronic Engineering

Fingerprint Dive into the research topics of 'Efficient pattern matching algorithm for memory architecture'. Together they form a unique fingerprint.

  • Cite this